Basic and Advanced Router Security Configuration - Revision history

Petlast at 22:42, 21 April 2011

2011-04-21T22:42:54Z

← Older revision		Revision as of 22:42, 21 April 2011
Line 113:		Line 113:
	*'''Router(config)# int ''''''[interface name, eg.'''''' fa0/1''']		*'''Router(config)# int ''''''[interface name, eg.'''''' fa0/1''']
	*'''Router(config-if)# shutdown'''		*'''Router(config-if)# shutdown'''

	~~Experiment: Configuring Basic security commands~~

Petlast at 22:14, 21 April 2011

2011-04-21T22:14:49Z

← Older revision		Revision as of 22:14, 21 April 2011
Line 113:		Line 113:
	*'''Router(config)# int ''''''[interface name, eg.'''''' fa0/1''']		*'''Router(config)# int ''''''[interface name, eg.'''''' fa0/1''']
	*'''Router(config-if)# shutdown'''		*'''Router(config-if)# shutdown'''

			Experiment: Configuring Basic security commands

Petlast at 22:13, 21 April 2011

2011-04-21T22:13:39Z

← Older revision		Revision as of 22:13, 21 April 2011
Line 45:		Line 45:
	A phenomenal amount of damage to routers and host computers alike comes from the internet. Firewalls, servers, and other methods of defense can prevent attacks and intrusion into the network, but the router itself has built-in abilities that allow it to protect itself from attacks fighting to get access. In this section, we will go over Advanced Security Commands, a plethora of configuration options that allow administrators to change password settings, block access from certain users, and deflect many different types of router manipulation. We will be able to secure ports and applications, disable unused services (router hardening), and block interfaces. Advanced security is advanced; a battle to stay one step ahead of anyone trying to permeate the router and the protection of your network.		A phenomenal amount of damage to routers and host computers alike comes from the internet. Firewalls, servers, and other methods of defense can prevent attacks and intrusion into the network, but the router itself has built-in abilities that allow it to protect itself from attacks fighting to get access. In this section, we will go over Advanced Security Commands, a plethora of configuration options that allow administrators to change password settings, block access from certain users, and deflect many different types of router manipulation. We will be able to secure ports and applications, disable unused services (router hardening), and block interfaces. Advanced security is advanced; a battle to stay one step ahead of anyone trying to permeate the router and the protection of your network.

	'''====Advanced security commands===='''		'''===Advanced security commands==='''

	*Block Denied Logins- Useful for delaying denied logins when someone is trying to brute force the router. (config)# login bock-for [seconds] attempts [attempts] within [seconds]		*Block Denied Logins- Useful for delaying denied logins when someone is trying to brute force the router. (config)# login bock-for [seconds] attempts [attempts] within [seconds]

	[[Image: login_block_small.png‎]]		[[Image: login_block_small.png‎]]
	*Quiet Login – Allows a user to still login once the router has blocked login attempts because of above.
	~~'''(config)# login quiet-mode access-class''' [acl]~~
	*Login Delay – Adds a delay at the point of a login being unsuccessful		*Login Delay – Adds a delay at the point of a login being unsuccessful
	'''(config)# login delay [seconds]		'''(config)# login delay [seconds]
Line 57:		Line 57:
	*Login Logging – Generates a log after a certain amount of failed or successful attempts.		*Login Logging – Generates a log after a certain amount of failed or successful attempts.
	'''(config)# login on-failure log''' [#]		'''(config)# login on-failure log''' [#]

			[[Image: success_login_small.png]]
			[[Image: fail_login_small.png]]
	*Min Password length – Ensures that any new password created on the router meets a minimum password length.		*Min Password length – Ensures that any new password created on the router meets a minimum password length.
	'''(config)# security password min-length [number of characters]		'''(config)# security password min-length [number of characters]

	[[Image: ~~success_login_small~~.png]]		[[Image: fail_login_small.png]]
	*Set Timeout – Sets a time out period for the connection line (con / vty).		*Set Timeout – Sets a time out period for the connection line (con / vty).
	'''(config-line)# exec-timeout''' [min/hour]		'''(config-line)# exec-timeout''' [min/hour]

Petlast at 21:38, 21 April 2011

2011-04-21T21:38:58Z

← Older revision		Revision as of 21:38, 21 April 2011
Line 76:		Line 76:

	:*Service Timestamp Logging: An application on the router that records debugging or system log events forwarded through the router. [debug]indicates timestamp is applied to debugging, [log]indicates system loggingg messages, [uptime] indicates the time the system was rebooted (listed in HHHH:MM:SS), [datetime] indicates the current time. and [year] indicates the year of the date.		:*Service Timestamp Logging: An application on the router that records debugging or system log events forwarded through the router. [debug]indicates timestamp is applied to debugging, [log]indicates system loggingg messages, [uptime] indicates the time the system was rebooted (listed in HHHH:MM:SS), [datetime] indicates the current time. and [year] indicates the year of the date.
	::*'''Service timestamps''' [debug \| log] [ uptime \| datetime [year]		::*'''Service timestamps''' [debug \| log] [ uptime \| datetime [year]
	:*Service Timestamp standard logging: A more simple version that only records events occuring on the system log.		:*Service Timestamp standard logging: A more simple version that only records events occuring on the system log.
	'''Service timestamps''' [log] [datetime] [msec] [show-timezone] [localtime]		'''Service timestamps''' [log] [datetime] [msec] [show-timezone] [localtime]

	===Disabling unused services/Router Hardening===		===Disabling unused services/Router Hardening===

Petlast at 21:37, 21 April 2011

2011-04-21T21:37:35Z

← Older revision		Revision as of 21:37, 21 April 2011
Line 44:		Line 44:
	===Prevent Access from the Internet===		===Prevent Access from the Internet===
	A phenomenal amount of damage to routers and host computers alike comes from the internet. Firewalls, servers, and other methods of defense can prevent attacks and intrusion into the network, but the router itself has built-in abilities that allow it to protect itself from attacks fighting to get access. In this section, we will go over Advanced Security Commands, a plethora of configuration options that allow administrators to change password settings, block access from certain users, and deflect many different types of router manipulation. We will be able to secure ports and applications, disable unused services (router hardening), and block interfaces. Advanced security is advanced; a battle to stay one step ahead of anyone trying to permeate the router and the protection of your network.		A phenomenal amount of damage to routers and host computers alike comes from the internet. Firewalls, servers, and other methods of defense can prevent attacks and intrusion into the network, but the router itself has built-in abilities that allow it to protect itself from attacks fighting to get access. In this section, we will go over Advanced Security Commands, a plethora of configuration options that allow administrators to change password settings, block access from certain users, and deflect many different types of router manipulation. We will be able to secure ports and applications, disable unused services (router hardening), and block interfaces. Advanced security is advanced; a battle to stay one step ahead of anyone trying to permeate the router and the protection of your network.
	Advanced security commands
	Block Denied Logins- Useful for delaying denied logins when someone is trying to brute force the router. (config)# login bock-for [seconds] attempts [attempts] within [seconds]		'''====Advanced security commands===='''
	Quiet Login – Allows a user to still login once the router has blocked login attempts because of above.		*Block Denied Logins- Useful for delaying denied logins when someone is trying to brute force the router. (config)# login bock-for [seconds] attempts [attempts] within [seconds]
	(config)# login quiet-mode access-class [acl]
	Login Delay – Adds a delay at the point of a login being unsuccessful		[[Image: login_block_small.png‎]]
	(config)# login delay [seconds]		*Quiet Login – Allows a user to still login once the router has blocked login attempts because of above.
	Login Logging – Generates a log after a certain amount of failed or successful attempts.		'''(config)# login quiet-mode access-class''' [acl]
	(config)# login on-failure log [#]		*Login Delay – Adds a delay at the point of a login being unsuccessful
	Min Password length – Ensures that any new password created on the router meets a minimum password length.		'''(config)# login delay [seconds]
	(config)# security password min-length [number of characters]
	Set Timeout – Sets a time out period for the connection line (con / vty).		[[Image: login_delay_small.png]]
	(config-line)# exec-timeout [min/hour]		*Login Logging – Generates a log after a certain amount of failed or successful attempts.
			'''(config)# login on-failure log''' [#]
			*Min Password length – Ensures that any new password created on the router meets a minimum password length.
			'''(config)# security password min-length [number of characters]

			[[Image: success_login_small.png]]
			*Set Timeout – Sets a time out period for the connection line (con / vty).
			'''(config-line)# exec-timeout''' [min/hour]

	====Securing ports and applications====		====Securing ports and applications====

Petlast at 21:20, 21 April 2011

2011-04-21T21:20:06Z

← Older revision		Revision as of 21:20, 21 April 2011
Line 58:		Line 58:

	====Securing ports and applications====		====Securing ports and applications====
	*Some beneficial services are not enabled by default that can be turned on.		*Some beneficial services are not enabled by default that can be turned on. These differ from enable and encryption commands as they are actions the router actively takes part in and incorporates in everyday activities.
	**Service tcp-keepalives-in		**Service tcp-keepalives-in/out: Prevents VTY and Line messages from being sent indefinitely. This command orders the router sends and recieve TCP keepalive messages. When a set amount of time has passed, the TCP protocol sends and empty TCP segment with only the ACK flag turned on. If the initiator sends a reply ACK, the connection resumes; but if not the router assumes the connection has died.
	**Service tcp-keepalives-out		***Service TCP-keepalives-in: generates keepalive packets on incoming network connections (initiated by remote hosts).
	**Service timestamps debug datetime ~~msec show-timezone localtime~~
	**Service timestamps log datetime msec show-timezone localtime		::*'''(config)# service tcp-keepalives-in'''
			::*'''(config)# end'''
			:*Service tcp-keepalives-out: Generates keepalive packets on outgoing network commands(initiated by user).
			::*'''(config)# service tcp-keepalives-out'''
			::*'''(config)# end'''

			:*Service Timestamp Logging: An application on the router that records debugging or system log events forwarded through the router. [debug]indicates timestamp is applied to debugging, [log]indicates system loggingg messages, [uptime] indicates the time the system was rebooted (listed in HHHH:MM:SS), [datetime] indicates the current time. and [year] indicates the year of the date.
			::*'''Service timestamps''' [debug \| log] [ uptime \| datetime [year]
			:*Service Timestamp standard logging: A more simple version that only records events occuring on the system log.
			'''Service timestamps''' [log] [datetime] [msec] [show-timezone] [localtime]

	===Disabling unused services/Router Hardening===		===Disabling unused services/Router Hardening===

Petlast at 20:31, 21 April 2011

2011-04-21T20:31:48Z

← Older revision		Revision as of 20:31, 21 April 2011
Line 22:		Line 22:
	*Encrypt passwords in your running configuration		*Encrypt passwords in your running configuration
	**Console passwords are written in cleartext by default. They can be encrypted by inputting '''(config)# enable password-encryption'''.		**Console passwords are written in cleartext by default. They can be encrypted by inputting '''(config)# enable password-encryption'''.
			[[Image: enable_password_encryption.png]]
	*Limit user capabilities with privilege level commands		*Limit user capabilities with privilege level commands
	**Enable global configuration mode passwords to prevent users from editing more than their level of authorization. Configured by entering '''(config)#''', '''enable secret''', followed by your chosen password.		**Enable global configuration mode passwords to prevent users from editing more than their level of authorization. Configured by entering '''(config)#''', '''enable secret''', followed by your chosen password.

Petlast at 20:03, 21 April 2011

2011-04-21T20:03:20Z

← Older revision		Revision as of 20:03, 21 April 2011
Line 24:		Line 24:
	*Limit user capabilities with privilege level commands		*Limit user capabilities with privilege level commands
	**Enable global configuration mode passwords to prevent users from editing more than their level of authorization. Configured by entering '''(config)#''', '''enable secret''', followed by your chosen password.		**Enable global configuration mode passwords to prevent users from editing more than their level of authorization. Configured by entering '''(config)#''', '''enable secret''', followed by your chosen password.
			[[Image: enable_secret.png]]
	*Set Telnet and Console passwords		*Set Telnet and Console passwords
	**Encrypt the lines that allows users over a network to interface with the router. Performed by entering '''(config)# line console 0''' for console, '''line vty''' for Telnet; enter and inputting login, enter, password, followed by your desired password.		**Encrypt the lines that allows users over a network to interface with the router. Performed by entering '''(config)# line console 0''' for console, '''line vty''' for Telnet; enter and inputting login, enter, password, followed by your desired password.

Petlast at 19:59, 21 April 2011

2011-04-21T19:59:02Z

← Older revision		Revision as of 19:59, 21 April 2011
Line 28:		Line 28:
	[[Image: vty_connection_password.png‎]]		[[Image: vty_connection_password.png‎]]

			[[Image: Configure_console_password.png]]
	===Password Retry Logout===		===Password Retry Logout===
	Besides the basic commands for router security, even the least sophisticated hackers can permeate the network using techniques such as DOS and brute force. In order to prevent these new attacks, we need more complex techniques to build on top of the security we already have.		Besides the basic commands for router security, even the least sophisticated hackers can permeate the network using techniques such as DOS and brute force. In order to prevent these new attacks, we need more complex techniques to build on top of the security we already have.

Petlast at 19:53, 21 April 2011

2011-04-21T19:53:16Z

← Older revision		Revision as of 19:53, 21 April 2011
Line 2:		Line 2:
	• A Router defines a network. From its security, to making computers more scalable and easy to configure, to breaking apart broadcast domains and verifying information reaches its intended purpose, routers are essential to the security line of work and the process of securing our information. As an integral part, a router requires its own standard protection which can be configured via the console port. Router policies that are the simplest are the most often overlooked, and require careful implementation.		• A Router defines a network. From its security, to making computers more scalable and easy to configure, to breaking apart broadcast domains and verifying information reaches its intended purpose, routers are essential to the security line of work and the process of securing our information. As an integral part, a router requires its own standard protection which can be configured via the console port. Router policies that are the simplest are the most often overlooked, and require careful implementation.

			[[Image: cisco.jpg\|right]]
	==Basic Router Security Configuration==		==Basic Router Security Configuration==
	*90% of all interactions users make with the router are through the virtual terminal server, or command line. Therefore, in order to prevent users from accessing data inside and outside the network, a network administrator needs to be proficient in using the command line to patch security flaws and implement countermeasures. There are several basic command line tools users can run that can secure the router, and by extension the entire network.		*90% of all interactions users make with the router are through the virtual terminal server, or command line. Therefore, in order to prevent users from accessing data inside and outside the network, a network administrator needs to be proficient in using the command line to patch security flaws and implement countermeasures. There are several basic command line tools users can run that can secure the router, and by extension the entire network.